Personal Data Processing Policy

1. General provisions

1.1. This Policy defines the procedures for processing and protecting personal data by ООО «ВСЕ ПРОЕКТЫ» (ALL PROJECTS LLC), hereinafter the Controller.

1.2. Controller: ООО «ВСЕ ПРОЕКТЫ», TIN 7743284901, PSRN 1187746991376; registered address: premises I, room 13, 7A Kronshtadtsky Boulevard, Moscow 125212, Russia; email: info@allprojects.ru.

1.3. This Policy applies to personal data received from users of the ALL PROJECTS website, including enquiries submitted through website forms.

1.4. This Policy is drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other applicable laws of the Russian Federation.

2. Categories of data subjects

Website visitors; individuals sending enquiries through the website; representatives of prospective or existing clients; representatives of suppliers, contractors and other counterparties; and other persons who voluntarily provide their personal data through the website.

3. Personal data processed via the website

Depending on the form or enquiry, the Controller may process: name, telephone number, email address, organisation name, job title, message or enquiry content, and other information voluntarily provided in the enquiry.

The Controller does not intentionally collect special categories of personal data or biometric personal data via its standard website forms.

4. Purposes of processing

Receiving and handling website enquiries; contacting users; providing information on ALL PROJECTS goods and services; preparing commercial proposals; discussing projects and technical solutions; discussing the supply of lighting and electrical equipment; preparing to enter into contracts; entering into and performing contracts; maintaining business correspondence; and complying with applicable laws of the Russian Federation.

Personal data are not used for advertising or marketing communications without a separate lawful basis and, where required by law, separate consent.

5. Legal bases for processing

Processing may be based on the data subject’s consent; steps to conclude a contract at the initiative of the data subject; performance of a contract to which the data subject is a party or beneficiary; compliance with legal obligations; or other grounds permitted by Russian law.

Where processing relies on consent, that consent is obtained separately from other documents and information acknowledged by the user, as required from 1 September 2025.

6. Processing operations

The Controller may collect, record, organise, accumulate, store, correct, update, retrieve, use, disclose where permitted by law or contract, restrict, delete and destroy personal data.

Processing may be automated or non-automated.

7. Processing and storage procedures

7.1. Data submitted through the website form are sent over a secure connection to the website server and then forwarded to the Controller’s corporate email address.

7.2. Access is limited to persons who require the data to handle enquiries, prepare responses or perform their duties.

7.3. Data are processed for the period required to achieve the relevant purpose.

7.4. If an enquiry results in a contract or another legal relationship, information and documents may be retained for periods required by Russian law.

7.5. Once the relevant purpose has been achieved, data are deleted, destroyed or anonymised unless another lawful basis for retention exists.

8. Disclosure to third parties

8.1. The Controller does not sell personal data or make them available to an unspecified public.

8.2. Personal data may be disclosed with the data subject’s consent; where necessary to perform a contract; in response to a lawful request from a court or competent authority; or to providers of the website, email and information systems under applicable legal grounds and contractual safeguards.

9. Data localisation

When collecting personal data of Russian citizens through the website, the Controller ensures that recording, organisation, accumulation, storage, updating and retrieval are carried out using databases located in the Russian Federation, except where Russian law expressly provides otherwise.

This requirement is established by Part 5 of Article 18 of Federal Law No. 152-FZ.

10. Personal data security

The Controller takes necessary and sufficient legal, organisational and technical measures to protect personal data against unauthorised or accidental access, destruction, alteration, restriction, copying, disclosure, dissemination and other unlawful actions.

Only persons who need the data to perform their functions are granted access.

11. Information about implemented personal data protection measures

ALL PROJECTS LLC (ООО «ВСЕ ПРОЕКТЫ») takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, disclosure, dissemination and other unlawful actions. Access to personal data is granted only to persons who require it to perform their official duties. Measures are applied to restrict access, protect information systems and monitor compliance with personal data protection legislation.

12. Rights of data subjects

Data subjects may obtain information about processing, request correction of incomplete or inaccurate data, request restriction or deletion where permitted by law, withdraw consent, request cessation of processing in cases provided by law, and appeal against the Controller’s actions or omissions.

Requests may be sent to info@allprojects.ru.

Withdrawal of consent does not prevent further processing where the Controller has another lawful basis.

13. Final provisions

13.1. This Policy is a publicly available document.

13.2. The current version is published on the ALL PROJECTS website.

13.3. The Controller may amend this Policy if Russian law, website operations, processed data categories or information systems change.

13.4. A new version takes effect upon publication on the website unless another effective date is stated.